Cosmos Server
Approved changes feed: RSS · Atom
cpe:2.3:a:azukaar:cosmos-server:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Azukaar (bf57cb5a-93b5-5397-a71d-8f097c8dd1c0) |
|---|---|
| Product | Cosmos Server (26ba9689-1582-5b91-be73-952673b4ed9d) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-49447 |
vulnerable | 2026-09-16 04:32:56.315348 |
Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens
MEDIUM (5.3)
Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, `GET /cosmos/api/constellation/public-devices` discloses Constellation device metadata to a requester that supplies any non-empty Authorization header. The handler strips the string Bearer from the header but never validates the resulting token and never uses it in the database query. This vulnerability is fixed in 0.22.19.
Published: 2026-07-28T20:35:36.636Z
Updated: 2026-07-29T13:36:42.108Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-23214 |
vulnerable | 2026-06-08 07:10:55.357194 |
Cosmos userbase checking vulnerability
Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. By monitoring the error code returned in the login, it is possible to figure out whether a user exist or not in the database. Patched in 0.17.7.
Published: 2025-01-20T18:09:45.996Z
Updated: 2025-02-12T20:41:20.065Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-49091 |
vulnerable | 2026-06-08 06:14:28.410637 |
Jwttoken in Cosmos server never expires after password changed and logging out
HIGH (8.8)
Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Cosmos-server is vulnerable due to to the authorization header used for user login remaining valid and not expiring after log out. This vulnerability allows an attacker to use the token to gain unauthorized access to the application/system even after the user has logged out. This issue has been patched in version 0.13.1.
Published: 2023-11-29T19:16:37.723Z
Updated: 2025-01-21T20:18:17.369Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.